@open-rap/runtime 0.0.0-stage → 0.1.0

package/dist/mcp/server.js

@@ -0,0 +1,222 @@
+/**
+ * The MCP server of the application (decision D47): the Model Context Protocol over HTTP
+ * ("Streamable HTTP" transport, JSON responses) at `/mcp`. Each tool is an OData request run by the
+ * service itself, as the user of the MCP request: authorizations, access controls, feature
+ * control, validations and messages are those of the OData service.
+ *
+ * Authentication: a bearer token (OIDC), or the development user with AUTH_MODE=none. Browser
+ * sessions (cookies) are not accepted: a web page could otherwise call the tools in the user's name.
+ */
+import { AuthenticationError } from "../auth/auth.js";
+import { withReader } from "../odata/access.js";
+export const MCP_PATH = "/mcp";
+/** Versions of the protocol this server speaks, the newest first. */
+const PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
+/** The literal of a key value in a key predicate or a function parameter. */
+function literal(edm, value) {
+    if (value === null || value === undefined) {
+        return "null";
+    }
+    switch (edm) {
+        case "Edm.String":
+            return `'${String(value).replace(/'/g, "''")}'`;
+        default:
+            return String(value);
+    }
+}
+function keyPredicate(tool, args) {
+    const keys = tool.call.keys;
+    const missing = keys.filter((k) => args[k.name] === undefined || args[k.name] === "");
+    if (missing.length > 0) {
+        throw new ToolInputError(`missing key ${missing.map((k) => k.name).join(", ")}`);
+    }
+    if (keys.length === 1 && keys[0] !== undefined) {
+        return `(${literal(keys[0].edm, args[keys[0].name])})`;
+    }
+    return `(${keys.map((k) => `${k.name}=${literal(k.edm, args[k.name])}`).join(",")})`;
+}
+class ToolInputError extends Error {
+}
+/** The fields of the arguments for the body of a create, an update or an action. */
+function body(tool, args) {
+    const result = {};
+    for (const field of tool.call.fields ?? []) {
+        if (args[field.name] !== undefined) {
+            result[field.name] = args[field.name];
+        }
+    }
+    return JSON.stringify(result);
+}
+/** The OData request of a tool call. */
+export function odataRequest(tool, args) {
+    const set = tool.call.set;
+    const json = { "content-type": "application/json", accept: "application/json", "if-match": "*" };
+    switch (tool.call.kind) {
+        case "list": {
+            const query = new URLSearchParams();
+            const top = typeof args["top"] === "number" ? Math.min(Math.max(1, Math.trunc(args["top"])), 1000) : 50;
+            query.set("$top", String(top));
+            query.set("$count", "true");
+            if (typeof args["skip"] === "number" && args["skip"] > 0)
+                query.set("$skip", String(Math.trunc(args["skip"])));
+            if (typeof args["filter"] === "string" && args["filter"].trim() !== "")
+                query.set("$filter", args["filter"]);
+            if (typeof args["orderby"] === "string" && args["orderby"].trim() !== "")
+                query.set("$orderby", args["orderby"]);
+            if (typeof args["search"] === "string" && args["search"].trim() !== "")
+                query.set("$search", args["search"]);
+            if (Array.isArray(args["select"]) && args["select"].length > 0)
+                query.set("$select", args["select"].map(String).join(","));
+            return { method: "GET", path: set, query: query.toString().replace(/\+/g, "%20"), headers: { accept: "application/json" } };
+        }
+        case "get":
+            return { method: "GET", path: `${set}${keyPredicate(tool, args)}`, query: "", headers: { accept: "application/json" } };
+        case "create":
+            return { method: "POST", path: set, query: "", headers: json, body: body(tool, args) };
+        case "createChild":
+            return { method: "POST", path: `${set}${keyPredicate(tool, args)}/${tool.call.navigation ?? ""}`, query: "", headers: json, body: body(tool, args) };
+        case "update":
+            return { method: "PATCH", path: `${set}${keyPredicate(tool, args)}`, query: "", headers: json, body: body(tool, args) };
+        case "delete":
+            return { method: "DELETE", path: `${set}${keyPredicate(tool, args)}`, query: "", headers: json };
+        case "action": {
+            const target = tool.call.collectionBound === true ? set : `${set}${keyPredicate(tool, args)}`;
+            return { method: "POST", path: `${target}/${tool.call.operation ?? ""}`, query: "", headers: json, body: body(tool, args) };
+        }
+        case "function": {
+            const target = tool.call.collectionBound === true ? set : `${set}${keyPredicate(tool, args)}`;
+            const parameters = (tool.call.fields ?? []).filter((f) => args[f.name] !== undefined).map((f) => `${f.name}=${literal(f.edm, args[f.name])}`);
+            return { method: "GET", path: `${target}/${tool.call.operation ?? ""}(${parameters.join(",")})`, query: "", headers: { accept: "application/json" } };
+        }
+    }
+}
+/** The text of an OData response for the agent: the JSON without the OData control information. */
+function resultText(status, text) {
+    if (status === 204 || text === undefined || text === "") {
+        return { text: status < 400 ? "Done." : `Failed (HTTP ${status}).`, error: status >= 400 };
+    }
+    try {
+        const json = JSON.parse(text);
+        if (status >= 400) {
+            const error = json["error"];
+            const details = (error?.details ?? []).map((d) => `- ${d.message ?? ""}${d.target === undefined ? "" : ` (${d.target})`}`);
+            return { text: [`Failed (HTTP ${status}): ${error?.message ?? text}`, ...details].join("\n"), error: true };
+        }
+        const clean = JSON.parse(JSON.stringify(json, (key, value) => (key.startsWith("@odata.") && key !== "@odata.count" ? undefined : key.startsWith("__") ? undefined : value)));
+        return { text: JSON.stringify(clean, null, 2), error: false, structured: clean };
+    }
+    catch {
+        return { text, error: status >= 400 };
+    }
+}
+export function registerMcp(app, options) {
+    const tools = new Map(options.tools.tools.map((t) => [t.name, t]));
+    const user = async (request) => {
+        const found = await options.authenticator.fromAuthorization(request.headers.authorization);
+        if (found === undefined) {
+            throw new AuthenticationError("a bearer token is required");
+        }
+        return found;
+    };
+    const call = async (who, params) => {
+        const name = String(params["name"] ?? "");
+        const tool = tools.get(name);
+        if (tool === undefined) {
+            throw new JsonRpcError(-32602, `unknown tool ${name}`);
+        }
+        const args = (typeof params["arguments"] === "object" && params["arguments"] !== null ? params["arguments"] : {});
+        let request;
+        try {
+            request = odataRequest(tool, args);
+        }
+        catch (error) {
+            if (error instanceof ToolInputError) {
+                return { content: [{ type: "text", text: error.message }], isError: true };
+            }
+            throw error;
+        }
+        const response = await withReader(who, () => options.handler.handle(request, { user: who, ieee754: false, language: "en" }));
+        const result = resultText(response.status, response.body);
+        return {
+            content: [{ type: "text", text: result.text }],
+            ...(result.structured !== undefined && typeof result.structured === "object" && !Array.isArray(result.structured) ? { structuredContent: result.structured } : {}),
+            isError: result.error,
+        };
+    };
+    const dispatch = async (who, message) => {
+        const id = message.id ?? null;
+        try {
+            let result;
+            switch (message.method) {
+                case "initialize": {
+                    const asked = typeof message.params?.["protocolVersion"] === "string" ? message.params["protocolVersion"] : undefined;
+                    result = {
+                        protocolVersion: asked !== undefined && PROTOCOL_VERSIONS.includes(asked) ? asked : PROTOCOL_VERSIONS[0],
+                        capabilities: { tools: { listChanged: false } },
+                        serverInfo: { name: options.tools.server.name, version: options.tools.server.version },
+                        ...(options.tools.server.instructions === undefined ? {} : { instructions: options.tools.server.instructions }),
+                    };
+                    break;
+                }
+                case "ping":
+                    result = {};
+                    break;
+                case "tools/list":
+                    result = {
+                        tools: options.tools.tools.map((t) => ({ name: t.name, title: t.title, description: t.description, inputSchema: t.inputSchema, annotations: { title: t.title, ...t.annotations } })),
+                    };
+                    break;
+                case "tools/call":
+                    result = await call(who, message.params ?? {});
+                    break;
+                default:
+                    if (message.method.startsWith("notifications/")) {
+                        return undefined;
+                    }
+                    throw new JsonRpcError(-32601, `method ${message.method} not found`);
+            }
+            return message.id === undefined ? undefined : { jsonrpc: "2.0", id, result };
+        }
+        catch (error) {
+            const code = error instanceof JsonRpcError ? error.code : -32603;
+            return message.id === undefined ? undefined : { jsonrpc: "2.0", id, error: { code, message: error.message } };
+        }
+    };
+    app.post(MCP_PATH, async (request, reply) => {
+        let who;
+        try {
+            who = await user(request);
+        }
+        catch (error) {
+            const status = error instanceof AuthenticationError ? error.status : 401;
+            return reply.status(status).header("WWW-Authenticate", 'Bearer realm="open-rap-runtime"').send({ jsonrpc: "2.0", id: null, error: { code: -32001, message: error.message } });
+        }
+        let payload;
+        try {
+            payload = typeof request.body === "string" ? JSON.parse(request.body) : request.body;
+        }
+        catch {
+            return reply.status(400).send({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "parse error" } });
+        }
+        const messages = (Array.isArray(payload) ? payload : [payload]);
+        if (messages.some((m) => typeof m !== "object" || m === null || typeof m.method !== "string")) {
+            return reply.status(400).send({ jsonrpc: "2.0", id: null, error: { code: -32600, message: "invalid request" } });
+        }
+        const responses = (await Promise.all(messages.map((m) => dispatch(who, m)))).filter((r) => r !== undefined);
+        if (responses.length === 0) {
+            return reply.status(202).send();
+        }
+        return reply.header("Content-Type", "application/json").send(JSON.stringify(Array.isArray(payload) ? responses : responses[0]));
+    });
+    // no server-sent events: the responses come in the body of the POST
+    app.get(MCP_PATH, async (_request, reply) => reply.status(405).header("Allow", "POST").send());
+    app.delete(MCP_PATH, async (_request, reply) => reply.status(405).header("Allow", "POST").send());
+}
+class JsonRpcError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+//# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,mBAAmB,EAAsB,MAAM,iBAAiB,CAAC;AAE1E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE/B,qEAAqE;AACrE,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAsBrE,6EAA6E;AAC7E,SAAS,OAAO,CAAC,GAAW,EAAE,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,YAAY;YACf,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;QAClD;YACE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAkB,EAAE,IAA6B;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,cAAc,CAAC,eAAe,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACvF,CAAC;AAED,MAAM,cAAe,SAAQ,KAAK;CAAG;AAErC,oFAAoF;AACpF,SAAS,IAAI,CAAC,IAAkB,EAAE,IAA6B;IAC7D,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,YAAY,CAAC,IAAkB,EAAE,IAA6B;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC1B,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACjG,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/G,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7G,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YACjH,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7G,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3H,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAC9H,CAAC;QACD,KAAK,KAAK;YACR,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;QAC1H,KAAK,QAAQ;YACX,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACzF,KAAK,aAAa;YAChB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACvJ,KAAK,QAAQ;YACX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1H,KAAK,QAAQ;YACX,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnG,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC9H,CAAC;QACD,KAAK,UAAU,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9F,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9I,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;QACxJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,UAAU,CAAC,MAAc,EAAE,IAAwB;IAC1D,IAAI,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,MAAM,IAAI,EAAE,KAAK,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACzD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAA6F,CAAC;YACxH,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YAC3H,OAAO,EAAE,IAAI,EAAE,CAAC,gBAAgB,MAAM,MAAM,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAc,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;QACjM,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAoB,EAAE,OAAmB;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,IAAI,GAAG,KAAK,EAAE,OAAuB,EAAiB,EAAE;QAC5D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC3F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAE,GAAS,EAAE,MAA+B,EAAoB,EAAE;QAClF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;QAC7I,IAAI,OAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;gBACpC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC7E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7H,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClK,OAAO,EAAE,MAAM,CAAC,KAAK;SACtB,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAS,EAAE,OAAuB,EAAwC,EAAE;QAClG,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,MAAe,CAAC;YACpB,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,KAAK,YAAY,EAAE,CAAC;oBAClB,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACtH,MAAM,GAAG;wBACP,eAAe,EAAE,KAAK,KAAK,SAAS,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;wBACxG,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;wBAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE;wBACtF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;qBAChH,CAAC;oBACF,MAAM;gBACR,CAAC;gBACD,KAAK,MAAM;oBACT,MAAM,GAAG,EAAE,CAAC;oBACZ,MAAM;gBACR,KAAK,YAAY;oBACf,MAAM,GAAG;wBACP,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;qBACrL,CAAC;oBACF,MAAM;gBACR,KAAK,YAAY;oBACf,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;oBAC/C,MAAM;gBACR;oBACE,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;wBAChD,OAAO,SAAS,CAAC;oBACnB,CAAC;oBACD,MAAM,IAAI,YAAY,CAAC,CAAC,KAAK,EAAE,UAAU,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACjE,OAAO,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3H,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACxE,IAAI,GAAS,CAAC;QACd,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;YACzE,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3L,CAAC;QACD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAqB,CAAC;QACpF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC9F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAClI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClI,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/F,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,YAAa,SAAQ,KAAK;IAEZ,IAAI;IADtB,YACkB,IAAY,EAC5B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;oBAHC,IAAI;IAItB,CAAC;CACF"}

package/dist/odata/access.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The access controls (DCL) on the reads of the service (decision D35): the conditions of the
+ * roles of an entity, evaluated for the user of the request into an SQL condition on the view
+ * of the entity. `aspect pfcg_auth` reads the authorizations of the user (D34) for the
+ * authorization object, `aspect user` its ABAP user name. As in ABAP CDS, a row is granted when
+ * one of the conditions of the roles of the entity is true; without role, every row is.
+ */
+import { type RawBuilder } from "kysely";
+import type { AbapType, AccessControlModel } from "@open-rap/model";
+import { type Authorizations } from "../auth/authorizations.js";
+import type { User } from "../auth/user.js";
+/** The user of the running read, if any. */
+export declare function currentReader(): User | undefined;
+/** Runs `fn` with the user whose access controls apply to the reads. */
+export declare function withReader<T>(user: User, fn: () => Promise<T>): Promise<T>;
+export declare class AccessControls {
+    private readonly authorizations;
+    private readonly byEntity;
+    constructor(controls: AccessControlModel[] | undefined, authorizations: Authorizations);
+    /**
+     * The SQL condition of the access controls of an entity for the user of the request, the
+     * elements read on `column`; undefined when the entity has no role (every row).
+     */
+    condition(entity: string, column: (element: string) => {
+        sql: RawBuilder<unknown>;
+        type: AbapType;
+    }): RawBuilder<unknown> | undefined;
+    private toSql;
+    /** `( E1, … ) = aspect pfcg_auth( OBJECT, F1, …, FILTER = 'v' )`: one authorization of the user grants the row. */
+    private pfcg;
+}

package/dist/odata/access.js

@@ -0,0 +1,142 @@
+/**
+ * The access controls (DCL) on the reads of the service (decision D35): the conditions of the
+ * roles of an entity, evaluated for the user of the request into an SQL condition on the view
+ * of the entity. `aspect pfcg_auth` reads the authorizations of the user (D34) for the
+ * authorization object, `aspect user` its ABAP user name. As in ABAP CDS, a row is granted when
+ * one of the conditions of the roles of the entity is true; without role, every row is.
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+import { sql } from "kysely";
+import { valueMatches } from "../auth/authorizations.js";
+import { toSql } from "../values.js";
+const reader = new AsyncLocalStorage();
+/** The user of the running read, if any. */
+export function currentReader() {
+    return reader.getStore();
+}
+/** Runs `fn` with the user whose access controls apply to the reads. */
+export function withReader(user, fn) {
+    return reader.run(user, fn);
+}
+/** A literal of a DCL condition (ABAP format: dates YYYYMMDD, booleans X) as a canonical value. */
+function literalValue(type, text) {
+    switch (type.kind) {
+        case "dats":
+            return /^\d{8}$/.test(text) ? `${text.slice(0, 4)}-${text.slice(4, 6)}-${text.slice(6, 8)}` : text;
+        case "tims":
+            return /^\d{6}$/.test(text) ? `${text.slice(0, 2)}:${text.slice(2, 4)}:${text.slice(4, 6)}` : text;
+        case "bool":
+            return text.trim() !== "";
+        case "int1":
+        case "int2":
+        case "int4":
+        case "fltp":
+            return Number(text);
+        default:
+            return text;
+    }
+}
+const escapeLike = (value) => value.replace(/[\\%_]/g, (c) => `\\${c}`);
+export class AccessControls {
+    authorizations;
+    byEntity = new Map();
+    constructor(controls, authorizations) {
+        this.authorizations = authorizations;
+        for (const control of controls ?? []) {
+            const key = control.entity.toUpperCase();
+            this.byEntity.set(key, [...(this.byEntity.get(key) ?? []), control]);
+        }
+    }
+    /**
+     * The SQL condition of the access controls of an entity for the user of the request, the
+     * elements read on `column`; undefined when the entity has no role (every row).
+     */
+    condition(entity, column) {
+        const controls = this.byEntity.get(entity.toUpperCase());
+        if (controls === undefined || controls.length === 0) {
+            return undefined;
+        }
+        const user = reader.getStore();
+        if (user === undefined) {
+            // a read outside of a request: nothing is granted
+            return sql `FALSE`;
+        }
+        if (this.authorizations.isUnrestricted(user)) {
+            return undefined;
+        }
+        const conditions = controls.flatMap((c) => c.conditions).map((c) => this.toSql(c, user, column));
+        return sql `(${sql.join(conditions, sql ` OR `)})`;
+    }
+    toSql(condition, user, column) {
+        switch (condition.kind) {
+            case "true":
+                return sql `TRUE`;
+            case "false":
+                return sql `FALSE`;
+            case "and":
+            case "or":
+                return condition.operands.length === 0 ? (condition.kind === "and" ? sql `TRUE` : sql `FALSE`) : sql `(${sql.join(condition.operands.map((o) => this.toSql(o, user, column)), condition.kind === "and" ? sql ` AND ` : sql ` OR `)})`;
+            case "not":
+                return sql `(NOT COALESCE(${this.toSql(condition.operand, user, column)}, FALSE))`;
+            case "null": {
+                const { sql: ref } = column(condition.element);
+                return condition.negated ? sql `(${ref} IS NOT NULL)` : sql `(${ref} IS NULL)`;
+            }
+            case "compare": {
+                const { sql: ref, type } = column(condition.element);
+                if (condition.operator === "like") {
+                    return sql `(CAST(${ref} AS text) LIKE ${condition.value})`;
+                }
+                return sql `(${ref} ${sql.raw(condition.operator)} ${toSql(type, literalValue(type, condition.value))})`;
+            }
+            case "user": {
+                const { sql: ref } = column(condition.element);
+                const own = sql `CAST(${ref} AS text) = ${user.abapName}`;
+                return condition.orInitial ? sql `(${own} OR ${ref} IS NULL OR CAST(${ref} AS text) = '')` : sql `(${own})`;
+            }
+            case "pfcg":
+                return this.pfcg(condition, user, column);
+        }
+    }
+    /** `( E1, … ) = aspect pfcg_auth( OBJECT, F1, …, FILTER = 'v' )`: one authorization of the user grants the row. */
+    pfcg(condition, user, column) {
+        const authorizations = this.authorizations.of(user, condition.object).filter((a) => Object.entries(condition.filters).every(([field, value]) => (a[field] ?? []).some((accepted) => valueMatches(value, accepted))));
+        const values = (ref, accepted) => {
+            const text = sql `CAST(${ref} AS text)`;
+            const parts = accepted.map((v) => {
+                if (typeof v !== "string") {
+                    return sql `(${text} BETWEEN ${v.from} AND ${v.to})`;
+                }
+                if (v === "*") {
+                    return sql `TRUE`;
+                }
+                if (v.endsWith("*")) {
+                    return sql `(${text} LIKE ${`${escapeLike(v.slice(0, -1))}%`})`;
+                }
+                return sql `(${text} = ${v})`;
+            });
+            return parts.length === 0 ? sql `FALSE` : sql `(${sql.join(parts, sql ` OR `)})`;
+        };
+        const granted = authorizations.map((authorization) => {
+            const checks = condition.elements.map((element, i) => {
+                const { sql: ref } = column(element);
+                const check = values(ref, authorization[condition.fields[i]] ?? []);
+                return condition.orInitial ? sql `(${check} OR ${ref} IS NULL OR CAST(${ref} AS text) = '')` : check;
+            });
+            return sql `(${sql.join(checks, sql ` AND `)})`;
+        });
+        if (granted.length === 0) {
+            if (!condition.orInitial) {
+                return sql `FALSE`;
+            }
+            // ?= : the rows whose elements are initial are granted without authorization
+            const initial = condition.elements.map((element) => {
+                const { sql: ref } = column(element);
+                return sql `(${ref} IS NULL OR CAST(${ref} AS text) = '')`;
+            });
+            return sql `(${sql.join(initial, sql ` AND `)})`;
+        }
+        return sql `(${sql.join(granted, sql ` OR `)})`;
+    }
+}
+//# sourceMappingURL=access.js.map

package/dist/odata/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/odata/access.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,GAAG,EAAmB,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAuB,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAE,KAAK,EAAuB,MAAM,cAAc,CAAC;AAE1D,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAQ,CAAC;AAE7C,4CAA4C;AAC5C,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAI,IAAU,EAAE,EAAoB;IAC5D,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CAAC,IAAc,EAAE,IAAY;IAChD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrG,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrG,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM;YACT,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAExF,MAAM,OAAO,cAAc;IAKN,cAAc;IAJhB,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEpE,YACE,QAA0C,EACzB,cAA8B;8BAA9B,cAAc;QAE/B,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,SAAS,CAAC,MAAc,EAAE,MAAyE;QACxG,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,kDAAkD;YAClD,OAAO,GAAG,CAAA,OAAO,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACjG,OAAO,GAAG,CAAA,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAA,MAAM,CAAC,GAAG,CAAC;IACnD,CAAC;IAEO,KAAK,CAAC,SAA0B,EAAE,IAAU,EAAE,MAAyE;QAC7H,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;YACvB,KAAK,MAAM;gBACT,OAAO,GAAG,CAAA,MAAM,CAAC;YACnB,KAAK,OAAO;gBACV,OAAO,GAAG,CAAA,OAAO,CAAC;YACpB,KAAK,KAAK,CAAC;YACX,KAAK,IAAI;gBACP,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM,CAAC,GAAG,CAAC;YACnO,KAAK,KAAK;gBACR,OAAO,GAAG,CAAA,iBAAiB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC;YACpF,KAAK,MAAM,EAAE,CAAC;gBACZ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC/C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAA,IAAI,GAAG,WAAW,CAAC;YAC/E,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBACf,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACrD,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBAClC,OAAO,GAAG,CAAA,SAAS,GAAG,kBAAkB,SAAS,CAAC,KAAK,GAAG,CAAC;gBAC7D,CAAC;gBACD,OAAO,GAAG,CAAA,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;YAC1G,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,GAAG,CAAA,QAAQ,GAAG,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzD,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,IAAI,GAAG,OAAO,GAAG,oBAAoB,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAA,IAAI,GAAG,GAAG,CAAC;YAC5G,CAAC;YACD,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,mHAAmH;IAC3G,IAAI,CAAC,SAAqD,EAAE,IAAU,EAAE,MAAyE;QACvJ,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrN,MAAM,MAAM,GAAG,CAAC,GAAwB,EAAE,QAA8B,EAAuB,EAAE;YAC/F,MAAM,IAAI,GAAG,GAAG,CAAA,QAAQ,GAAG,WAAW,CAAC;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC/B,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC1B,OAAO,GAAG,CAAA,IAAI,IAAI,YAAY,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;gBACtD,CAAC;gBACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBACd,OAAO,GAAG,CAAA,MAAM,CAAC;gBACnB,CAAC;gBACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpB,OAAO,GAAG,CAAA,IAAI,IAAI,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;gBACjE,CAAC;gBACD,OAAO,GAAG,CAAA,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAA,MAAM,CAAC,GAAG,CAAC;QAChF,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;gBACnD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAW,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9E,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,IAAI,KAAK,OAAO,GAAG,oBAAoB,GAAG,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;YACtG,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,CAAA,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAA,OAAO,CAAC,GAAG,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAA,OAAO,CAAC;YACpB,CAAC;YACD,6EAA6E;YAC7E,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;gBACjD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;gBACrC,OAAO,GAAG,CAAA,IAAI,GAAG,oBAAoB,GAAG,iBAAiB,CAAC;YAC5D,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,CAAA,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAA,OAAO,CAAC,GAAG,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAA,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAA,MAAM,CAAC,GAAG,CAAC;IAChD,CAAC;CACF"}

package/dist/odata/batch.d.ts

@@ -0,0 +1,36 @@
+/** OData $batch in multipart/mixed format: parsing of requests and serialization of responses. */
+export interface BatchRequestPart {
+    method: string;
+    /** URL as written in the part, relative to the service root (or absolute). */
+    url: string;
+    headers: Record<string, string>;
+    body: string;
+    contentId?: string;
+}
+export type BatchItem = {
+    kind: "request";
+    request: BatchRequestPart;
+} | {
+    kind: "changeset";
+    requests: BatchRequestPart[];
+};
+export interface BatchResponsePart {
+    status: number;
+    statusText?: string;
+    headers: Record<string, string>;
+    body?: string;
+    contentId?: string;
+}
+export type BatchResponseItem = {
+    kind: "response";
+    response: BatchResponsePart;
+} | {
+    kind: "changeset";
+    responses: BatchResponsePart[];
+};
+export declare function boundaryOf(contentType: string | undefined): string;
+export declare function parseBatch(body: string, contentType: string | undefined): BatchItem[];
+export declare function serializeBatch(items: BatchResponseItem[]): {
+    contentType: string;
+    body: string;
+};

package/dist/odata/batch.js

@@ -0,0 +1,147 @@
+/** OData $batch in multipart/mixed format: parsing of requests and serialization of responses. */
+import { randomUUID } from "node:crypto";
+import { badRequest } from "./errors.js";
+export function boundaryOf(contentType) {
+    const match = /boundary=(?:"([^"]+)"|([^;\s]+))/i.exec(contentType ?? "");
+    const boundary = match?.[1] ?? match?.[2];
+    if (boundary === undefined) {
+        throw badRequest("The $batch request has no multipart boundary");
+    }
+    return boundary;
+}
+function splitParts(body, boundary) {
+    const delimiter = `--${boundary}`;
+    const parts = [];
+    let index = body.indexOf(delimiter);
+    if (index < 0) {
+        throw badRequest("The $batch body does not contain its boundary");
+    }
+    while (index >= 0) {
+        const start = index + delimiter.length;
+        if (body.startsWith("--", start)) {
+            break; // close delimiter
+        }
+        const next = body.indexOf(`\n${delimiter}`, start);
+        const end = next < 0 ? body.length : next;
+        parts.push(body.slice(start, end).replace(/^[ \t]*\r?\n/, "").replace(/\r$/, ""));
+        index = next < 0 ? -1 : next + 1;
+    }
+    return parts;
+}
+function splitHead(text) {
+    const match = /\r?\n\r?\n/.exec(text);
+    if (match === null) {
+        return { head: text.split(/\r?\n/).filter((l) => l !== ""), rest: "" };
+    }
+    return { head: text.slice(0, match.index).split(/\r?\n/), rest: text.slice(match.index + match[0].length) };
+}
+function headersOf(lines) {
+    const headers = {};
+    for (const line of lines) {
+        const colon = line.indexOf(":");
+        if (colon > 0) {
+            headers[line.slice(0, colon).trim().toLowerCase()] = line.slice(colon + 1).trim();
+        }
+    }
+    return headers;
+}
+function parseRequest(part, mimeHeaders) {
+    const { head, rest } = splitHead(part);
+    const requestLine = head[0] ?? "";
+    const match = /^(GET|POST|PATCH|PUT|DELETE|HEAD)\s+(\S+)(?:\s+HTTP\/1\.1)?$/i.exec(requestLine.trim());
+    if (match === null) {
+        throw badRequest(`Invalid request line in $batch: ${requestLine}`);
+    }
+    const request = {
+        method: match[1].toUpperCase(),
+        url: match[2],
+        headers: headersOf(head.slice(1)),
+        body: rest.replace(/\r?\n$/, ""),
+    };
+    const contentId = mimeHeaders["content-id"];
+    if (contentId !== undefined) {
+        request.contentId = contentId;
+    }
+    return request;
+}
+export function parseBatch(body, contentType) {
+    const boundary = boundaryOf(contentType);
+    const items = [];
+    for (const part of splitParts(body, boundary)) {
+        const { head, rest } = splitHead(part);
+        const headers = headersOf(head);
+        const type = headers["content-type"] ?? "";
+        if (/^multipart\/mixed/i.test(type)) {
+            const inner = boundaryOf(type);
+            const requests = splitParts(rest, inner).map((p) => {
+                const split = splitHead(p);
+                return parseRequest(split.rest, headersOf(split.head));
+            });
+            for (const r of requests) {
+                if (r.method === "GET") {
+                    throw badRequest("A change set cannot contain GET requests");
+                }
+            }
+            items.push({ kind: "changeset", requests });
+        }
+        else if (/^application\/http/i.test(type)) {
+            items.push({ kind: "request", request: parseRequest(rest, headers) });
+        }
+        else {
+            throw badRequest(`Unexpected $batch part of type ${type || "(none)"}`);
+        }
+    }
+    return items;
+}
+const STATUS_TEXT = {
+    200: "OK",
+    201: "Created",
+    204: "No Content",
+    304: "Not Modified",
+    400: "Bad Request",
+    401: "Unauthorized",
+    403: "Forbidden",
+    404: "Not Found",
+    405: "Method Not Allowed",
+    406: "Not Acceptable",
+    409: "Conflict",
+    412: "Precondition Failed",
+    415: "Unsupported Media Type",
+    423: "Locked",
+    428: "Precondition Required",
+    500: "Internal Server Error",
+    501: "Not Implemented",
+};
+function serializeResponse(response) {
+    const lines = ["Content-Type: application/http", "Content-Transfer-Encoding: binary"];
+    if (response.contentId !== undefined) {
+        lines.push(`Content-ID: ${response.contentId}`);
+    }
+    lines.push("", `HTTP/1.1 ${response.status} ${response.statusText ?? STATUS_TEXT[response.status] ?? ""}`.trimEnd());
+    for (const [name, value] of Object.entries(response.headers)) {
+        lines.push(`${name}: ${value}`);
+    }
+    lines.push("", response.body ?? "");
+    return lines.join("\r\n");
+}
+export function serializeBatch(items) {
+    const boundary = `batchresponse_${randomUUID()}`;
+    const chunks = [];
+    for (const item of items) {
+        chunks.push(`--${boundary}`);
+        if (item.kind === "response") {
+            chunks.push(serializeResponse(item.response));
+        }
+        else {
+            const inner = `changesetresponse_${randomUUID()}`;
+            chunks.push(`Content-Type: multipart/mixed; boundary=${inner}`, "");
+            for (const response of item.responses) {
+                chunks.push(`--${inner}`, serializeResponse(response));
+            }
+            chunks.push(`--${inner}--`);
+        }
+    }
+    chunks.push(`--${boundary}--`, "");
+    return { contentType: `multipart/mixed; boundary=${boundary}`, body: chunks.join("\r\n") };
+}
+//# sourceMappingURL=batch.js.map

package/dist/odata/batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.js","sourceRoot":"","sources":["../../src/odata/batch.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAElG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuBzC,MAAM,UAAU,UAAU,CAAC,WAA+B;IACxD,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,UAAU,CAAC,8CAA8C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAgB;IAChD,MAAM,SAAS,GAAG,KAAK,QAAQ,EAAE,CAAC;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,UAAU,CAAC,+CAA+C,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC;QACvC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,kBAAkB;QAC3B,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAClF,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED,SAAS,SAAS,CAAC,KAAe;IAChC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,WAAmC;IACrE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,+DAA+D,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACvG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,UAAU,CAAC,mCAAmC,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAqB;QAChC,MAAM,EAAG,KAAK,CAAC,CAAC,CAAY,CAAC,WAAW,EAAE;QAC1C,GAAG,EAAE,KAAK,CAAC,CAAC,CAAW;QACvB,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;KACjC,CAAC;IACF,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,WAA+B;IACtE,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACjD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC3B,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBACvB,MAAM,UAAU,CAAC,0CAA0C,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,CAAC,kCAAkC,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,WAAW,GAA2B;IAC1C,GAAG,EAAE,IAAI;IACT,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,gBAAgB;IACrB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,qBAAqB;IAC1B,GAAG,EAAE,wBAAwB;IAC7B,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,uBAAuB;IAC5B,GAAG,EAAE,uBAAuB;IAC5B,GAAG,EAAE,iBAAiB;CACvB,CAAC;AAEF,SAAS,iBAAiB,CAAC,QAA2B;IACpD,MAAM,KAAK,GAAG,CAAC,gCAAgC,EAAE,mCAAmC,CAAC,CAAC;IACtF,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACrH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,QAAQ,GAAG,iBAAiB,UAAU,EAAE,EAAE,CAAC;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,qBAAqB,UAAU,EAAE,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,2CAA2C,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YACpE,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,EAAE,WAAW,EAAE,6BAA6B,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AAC7F,CAAC"}

package/dist/odata/csrf.d.ts

@@ -0,0 +1,13 @@
+/**
+ * CSRF tokens in the SAP Gateway style: a client fetches a token with `X-CSRF-Token: Fetch` on a
+ * GET or HEAD request, and sends it back on modifying requests. Only requests authenticated by a
+ * session cookie need it: bearer tokens and the development mode carry no ambient credentials.
+ */
+import type { User } from "../auth/user.js";
+export declare class CsrfTokens {
+    private readonly secret;
+    constructor(secret?: string);
+    token(user: User, session?: string): string;
+    valid(user: User, token: string | undefined, session?: string): boolean;
+    required(user: User, method: string): boolean;
+}